vBulletin fixes critical pre-auth RCE flaw with public exploit
vBulletin has fixed a critical pre-auth RCE flaw in its forum software, tracked as CVE-2026-61511, which affects versions 5.x and 6.x up to 5.7.5 and 6.2.1. The flaw allows unauthenticated attackers to execute arbitrary PHP code through template rendering.
Intelligence analysis by Llama
vBulletin has patched a critical vulnerability in its forum software that allows attackers to execute arbitrary code. The flaw affects versions 5.x and 6.x up to 5.7.5 and 6.2.1.
Imagine you have a website where people can talk to each other. But, there's a way for someone to send a special message that can make the website do anything they want. That's what happened with vBulletin, a website where people can talk to each other. Someone found a way to send a special message that can make the website do anything they want. This is called a vulnerability, and it's like a backdoor that someone can use to get into the website.
Analysis
A Critical Flaw in vBulletin's Forum Software
vBulletin, a PHP-based proprietary forum platform, has a critical vulnerability in its forum software that allows unauthenticated attackers to execute arbitrary PHP code through template rendering. The security issue is tracked as CVE-2026-61511 and affects vBulletin versions in the 5.x and 6.x branches up to 5.7.5 and 6.2.1, respectively.
The flaw is caused by the ‘runMaths()’ function, which doesn’t properly sanitize user input before passing it to PHP's eval() function, which should be limited to mathematical expressions only. The researcher found that unauthenticated attackers can exploit the flaw by sending a specially crafted request to the 'ajax/render/[template]' endpoint. The request is processed by a vulnerable template, like 'pagenav', that ultimately passes attacker-controlled input to PHP's eval() function, resulting in remote code execution.
SSD Secure Disclosure has also published a technical analysis for CVE-2026-61511, explaining that the sanitization restrictions can be bypassed using the so-called “phpfuck” technique. The researchers also published a proof-of-concept (PoC) exploit targeting the ajax/render/pagenav route and executing arbitrary system commands on vulnerable servers.
The availability of a public PoC for CVE-2026-61511 lowers the barrier for attackers and typically leads to increased scanning and exploitation attempts against unpatched internet-facing vBulletin servers. This was highlighted in May 2025, when threat actors used public PoCs for two critical vBulletin flaws, also discovered by Romano, to target unpatched instances.
CVE-2026-61511 was reported to vBulletin on June 25, 2026, and version 6.2.2, which addressed the flaw, was released on July 1. Security patches were backported to earlier releases, tagged as ‘Patch Level 1,’ including for v6.2.1, v6.2.0, and v.6.1.6. Wayne Luke, vBulletin’s technical support lead, stated on the project’s forums that users of older versions should upgrade to a newer release, so it can be deduced that there will be no updates to address CVE-2026-61511 in the 5.x branch.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper
Key points
- vBulletin has fixed a critical pre-auth RCE flaw in its forum software, tracked as CVE-2026-61511.
- The flaw affects versions 5.x and 6.x up to 5.7.5 and 6.2.1.
- The flaw allows unauthenticated attackers to execute arbitrary PHP code through template rendering.
- CVE-2026-61511 was reported to vBulletin on June 25, 2026, and version 6.2.2, which addressed the flaw, was released on July 1.
- Security patches were backported to earlier releases, tagged as ‘Patch Level 1,’ including for v6.2.1, v6.2.0, and v.6.1.6.
vBulletin has fixed the vulnerability, and users of the platform should upgrade to the latest version to ensure their security. Additionally, security teams can use breach and attack simulation tests to test their SIEM and EDR rules and prevent similar threats from slipping by detection.
The availability of a public PoC for CVE-2026-61511 lowers the barrier for attackers and typically leads to increased scanning and exploitation attempts against unpatched internet-facing vBulletin servers. This could lead to a significant number of successful attacks and compromises of the vBulletin platform.
